CVE-2022-30592
📋 TL;DR
This vulnerability in LiteSpeed QUIC (LSQUIC) before version 3.1.0 involves improper handling of MAX_TABLE_CAPACITY in the QPACK encoder, which can lead to a NULL pointer dereference. Attackers can exploit this to cause denial of service or potentially execute arbitrary code. Any system using vulnerable LSQUIC versions is affected.
💻 Affected Systems
- LiteSpeed QUIC (LSQUIC)
- LiteSpeed Web Server
- OpenLiteSpeed
- Applications using LSQUIC library
📦 What is this software?
Lsquic by Litespeedtech
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Denial of service causing service disruption
If Mitigated
Service interruption with no data loss if proper segmentation exists
🎯 Exploit Status
CVSS 9.8 indicates critical severity with low attack complexity and no authentication required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.0 and later
Vendor Advisory: https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0
Restart Required: Yes
Instructions:
1. Download LSQUIC v3.1.0 or later from GitHub releases
2. Replace existing LSQUIC installation with patched version
3. Recompile any applications using LSQUIC library
4. Restart affected services
🔧 Temporary Workarounds
Disable QUIC protocol
allTemporarily disable QUIC protocol to mitigate vulnerability
# For LiteSpeed Web Server: edit configuration to disable QUIC
# In httpd_config.conf: set enableQuic to 0
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy WAF rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check LSQUIC library version: lsquic-config --version or examine linked library version in applicationsCheck Version:
lsquic-config --version || strings /path/to/liblsquic.so | grep 'LSQUIC_'Verify Fix Applied:
Verify version is 3.1.0 or higher and check for commit a74702c630e108125e71898398737baec8f02238📡 Detection & Monitoring
Log Indicators:
- Unexpected service crashes
- Memory access violation errors
- QUIC connection failures
Network Indicators:
- Malformed QUIC packets targeting MAX_TABLE_CAPACITY
- Unusual QUIC protocol traffic patterns
SIEM Query:
source="*lsquic*" AND ("segmentation fault" OR "null pointer" OR "MAX_TABLE_CAPACITY")🔗 References
- https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e71898398737baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae
- https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0
- https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e71898398737baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae
- https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0
